Recent content in Home on Just Milhouse
Working in Pitch , I had the opportunity to read, review, and code in Clojure and Clojurescript. Clojure is a niche programming language, a Lisp language hosted on a JVM, and it has a small, but “senior”, community. ClojureScript is a variant of Clojure that compiles to JavaScript (instead of JVM), so it is a sort of Clojure for the JavaScript ecosystem, with (almost) the same…

 ❗️Disclosure: I work at Pitch since December 2021. This write-up aggregates public knowledge previously shared by third parties (e.g., security firms, infosec community, etc.) or us. I hope this can be helpful for younger security teams that need to understand how to identify and mitigate phishing abuses for the first time. 
 Threat model 
 When you work in the startup ecosystem long…

 ❗️Disclosure: I worked at Smallpdf from January to November 2021. In that period, Smallpdf used PDFTron WebViewer SDK (now Apryse PDF WebViewer) to render PDF files in the browser. This information was public . 
 Interview and first XSS in PDFTron WebViewer 
 In October 2020, I started my job interview with Smallpdf for a Cloud Security Engineer position. During the interview…
This website is a static open-source website, hosted on GitHub . It’s a personal blog, I do not care to collect visitor data and I try to be careful about cookies on the site, but some pages could have third-party cookies or trackers due to embedded content (e.g. YouTube videos, embedded tweets, etc). Feel free to navigate this website using ad-blockers. 
 Cookies 
 To know how to…
Italy is facing dark days because of coronavirus and there is a lot of disinformation about this topic, especially on messaging apps and social networks (the journalist Jane Lytvynenko is collecting and debunking a large number of fake news about COVID-19). Last week ( 03/12 ) China sent a team of doctors and equipment for Italian hospitals, a part of which Italy will pay for. The Chinese Embassy…
During last spring (2019) I started to “open and read” the Android applications before installing them. Reversing an APK file can be interesting to understand how an app works, how it manages the permissions and my data, if there are vulnerabilities. I was looking for a different Android mail client, so I started to reverse them and I found many mail clients on Play Store were - maybe…
Some days ago the journalist Charlotte Godart contacted me and asked me to explain how to use my script tweet_analysis.py . Her goal was to convert Twitter datasets about Chinese propaganda into graphs, so that people can see how the Chinese government operates on Twitter to influence their opinion. While helping her I had the possibility to take a look at these datasets and they are intriguing,…
This is the third and last post about the Internet Research Agency dataset, which was shared by Twitter in October 2018. In Part II I have focused on the European situation – especially in Germany, Italy, France and Spain – to understand if the Russian government might have tried to spread disinformation as it did in the US. In this post I want to focus on Italy and answer to the question: has the…
Questo post doveva essere pubblicato verso giugno 2019, l’ho scritto in quel periodo, poi si sa, è facile procrastinare, gli imprevisti sono dietro l’angolo, le scalette personali mutano, capitano settimane impegnative, e le bozze rimangono salvate a prendere polvere. Ci tengo molto a ringraziare le persone - tante - che mi hanno fatto sentire il proprio sostegno, in vari modi, durante…
In this post I will move forward on the analysis of Twitter datasets, that I have started in December. You can read the previous post, “About Iran and IRA Twitter datasets (for fun) – Part I” . This time I have focused on the potential Russian propaganda in Europe, so I have decided to analyse the tweets written in German , Italian , Spanish , French , Dutch and Danish . I have left…
Info 
 Vendor: D-Link Italia 
 Product: Router DVA-5592 
 Firmware: DVA-5592_A1_WI_20180823 
 CVE: 2018-17777 
 Shodan: ADB Broadband HTTP Server" title:“D-Link” 
 Description 
 In the router D-Link DVA-5592 it is possible to bypass the web authentication form. The problem is the path /ui/cbpc/login , because it is accessible without authentication. If the…
On 17 October 2018 Twitter released two datasets about the propaganda accounts of the Internet Research Agency (IRA) and Iran. Each dataset has three parts: a CSV file with the user list, a CSV file with all* the tweets of said users and a dataset of the shared images and memes. For fun I tried to use pandas and matplotlib to read the data. To read the file ira_tweets_csv_hashed.csv (5,4 GB) I…
Poco tempo fa ho scoperto un progetto open source chiamato Pi-Hole , piuttosto conosciuto e apprezzato. Il compito di Pi-Hole è quello di “ripulire” la nostra navigazione su Internet da pubblicità e siti malevoli (semplificando: funge da ad-block), creando un piccolo server DNS sul Raspberry. Uno dei principali punti di forza è che, una volta configurato, ripulisce dalle pubblicità…
Circa due settimane fa, a Padova, si è tenuto l’evento Italian Hacker Camp 2018 , un vero e proprio campeggio per appassionati del mondo dell’informatica (ma non solo). L’evento si è svolto dal 2 al 5 agosto e offriva alle persone, come si può intuire dal nome, la possibilità di fermarsi lì con la propria tenda e il proprio sacco a pelo per tutta la durata dell’evento. Non…
Summary 
 In Simplenote 1.1.3 - Desktop app there is a stored XSS vulnerability that can be used to execute arbitrary code. If there is malicious code in the note and the user tries to print it (for example to save it as a PDF), the malicious code runs. 
 
 
 


Qualche giorno fa il giornalista de Il Post Emanuele Menietti ha tweetato questo: 
 ci sarà pur un modo per filtrare tutti quelli con la bandierina dell'italia nel nome del profilo e con foto che non troveresti manco sulle credenze nei tinelli a predappio. — emanuele menietti (@emenietti) July 7, 2018 
 


 Mi sono quindi domandato se c’è un modo veloce per filtrare…
A few days ago some researchers discovered an HTML Injection vulnerability in Signal Desktop and they wrote a public disclosure . The Signal team quickly released an update on May 11th, the problem was in the file /js/views/message_view.js . 
 Reading the changes to message_view.js , it seemed that the Signal team had only fixed the “ problem of the URL ". So, maybe, I could still inject…
Info 
 Product: GD bbPress Attachments 
 Version: 2.5 
 Active installations: 10,000+ 
 Product page: https://it.wordpress.org/plugins/gd-bbpress-attachments/ 
 Description 
 An authenticated user of a bbPress forum, who can attach a file, can inject arbitrary javascript code via filename. The arbitrary code runs both on the topic page and in the admin panel, and it only…
After many unsuccessful attempts to find an XSS in Yahoo’s domains, I decided to move my attention to Microsoft Bing. 
If you have a Microsoft account, Bing allows you to save online content (images, videos and places) on the page My saves , and allows to create collections to better manage your own content. 
The titles of these collections were not properly filtered, so it was…
Info 
 Product: WP Live Chat Support 
 Version: 8.0.05 
 Active installations: 50,000+ 
 Product page: https://wordpress.org/plugins/wp-live-chat-support/ 
 CVE: 2018-9864 
 1. 
 Description 
 An unauthenticated user could inject arbitrary javascript code in the admin panel by using the text field Name of WP Live Chat Support. 
 Using a single input point it was…
Info 
 Product: Events Manager 
 Version: 5.8.1.1 
 Active installations: 100,000+ 
 Product page: https://it.wordpress.org/plugins/events-manager/ 
 CVE: 2018-9020 
 Description 
 An unauthenticated user or a user without privileges, who can submit an event, can inject javascript code in the Google Maps miniature. The malicious code runs in the admin panel when a user…
In November, I reported various persistent XSS vulnerabilities in AOL Mail to the AOL Security Team. They replied quickly and fixed the vulnerabilities in less than 90 days. 
 1. 
 Using an unclosed tag, it was possible to inject arbitrary javascript code. The payload ran as soon as the victim opened the site mail.aol.com because the code was in the e-mail preview. 
 
 
…
Qualche mese fa ho comprato un Raspberry Pi 3 Model B, l’ho comprato per curiosità, per giocarci (letteralmente). Nelle settimane successive ho acquistato un piccolo schermo da 3,5 pollici , una powerbank e un paio di joystick (modello Nintendo SNES) e grazie al bellissimo progetto RetroPie ho trasformato il mio Raspberry in una console portatile di giochi retro. 
 L’obiettivo di…
Info 
 Product: Bookly #1 WordPress Booking Plugin (Lite Version) 
 Version: 13.2 
 Active installations: 10,000+ 
 Product page: https://wordpress.org/plugins/bookly-responsive-appointment-booking-tool/ 
 CVE: 2018-6891 
 Description 
 An unauthenticated user can inject arbitrary persistent javascript code in the admin panel. 
 Proof of Concept 
 
 
…
ZOHO Mail is a business mail that includes integrated calendar, contacts, notes, and tasks apps. Initially I was looking for a stored XSS in the webmail, but I did not find it so I started checking the other services. I wondered if it was possible to inject malicious code via attachments in ZOHO Notes. By attaching a local file it wasn’t, but in ZOHO Notes you can attach files from some…
This is my first public disclosure on HackerOne. It is a partial disclosure, but the summary is clear: there was a stored XSS in the image preview feature via crafted attachment filename. 
 #275274 - touch.mail.ru/messages - Stored XSS 
 07/10/2017 - I send the report 
 11/10/2017 - The vulnerability is fixed and the bug bounty reward is 750$ 
 27/12/2017 - Public disclosure
In my own spare time I like to participate in the bug bounty programs. They are a hard challenge, but it is satisfying to find vulnerabilities in big companies. I usually look for XSS vulnerabilities, for this reason I have written a little python script to automate the search of XSS. 
 
 XSSSonar is an open source tool to look for XSS vulnerabilities on a web page, it is written in Python…